Privacy policy

1. General provisions

1.1. This Privacy Policy (the “Policy”) sets out how personal data of users of the Nysana Studio website (the “Website”) is collected, processed, stored and protected. It has been prepared in accordance with Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 “On Personal Data and Its Protection” (the “Law”).

1.2. The owner and operator of the personal data is Nysana Studio, Astana, Republic of Kazakhstan (the “Operator”).

1.3. By submitting personal data through the Website forms, the User confirms that they have read this Policy and agree to its terms. If the User does not agree with the Policy, they should refrain from submitting their personal data.

1.4. The Policy applies to the Website only. The Operator does not control third-party websites that may be reached through links on the Website and is not responsible for their content or data processing practices.

2. Definitions

2.1. Personal data means information relating to an identified or identifiable data subject, recorded on electronic, paper and/or other tangible media.

2.2. User (data subject) means an individual who uses the Website and to whom the personal data relates.

2.3. Processing of personal data means actions aimed at accumulating, storing, modifying, supplementing, using, disseminating, depersonalising, blocking and destroying personal data.

2.4. Depersonalisation of personal data means actions as a result of which personal data can no longer be attributed to a data subject.

2.5. Other terms have the meanings established by the laws of the Republic of Kazakhstan.

3. Personal data processed

3.1. The Operator processes personal data that the User voluntarily provides when filling in forms on the Website:

• name;
• phone number;
• preferred contact channel;
• a link to a website or social media page — when requesting an audit;
• the content of the request and answers to the price calculator questions.

3.2. When a form is submitted and the Website is used, technical data is processed automatically: the page address, traffic source, advertising campaign parameters, the date and time of the request, and a depersonalised technical identifier that does not allow the User’s IP address to be determined. The use of cookies is governed by the Cookie Policy.

3.3. The Operator does not collect or process biometric data or information about the User’s racial or ethnic origin, political views, religious beliefs, health or private life.

3.4. If the User is a minor, consent to the processing of their personal data is given by their legal representative in accordance with the laws of the Republic of Kazakhstan.

4. Purposes of processing

4.1. Personal data is processed for the following purposes:

• handling the User’s requests and enquiries and replying through the channel they chose;
• preparing a price estimate, a commercial offer and express audit results;
• entering into and performing contracts with the User;
• analysing performance and improving the Website based on depersonalised data;
• complying with the laws of the Republic of Kazakhstan.

4.2. The Operator does not use personal data to make decisions with legal consequences for the User based solely on automated processing.

5. Legal grounds for processing

5.1. Personal data is processed on the basis of:

• the User’s consent, given by ticking the relevant box in a form;
• a contract to which the User is or intends to become a party;
• the requirements of the laws of the Republic of Kazakhstan.

6. Processing procedure and conditions

6.1. Personal data is processed with and without automation tools, in compliance with the principles of lawfulness, confidentiality and consistency with the purposes of processing.

6.2. Personal data is stored in a database located in the Republic of Kazakhstan, as required by Article 12 of the Law.

6.3. Access to personal data is granted only to the Operator’s authorised persons and only to the extent necessary for their duties.

6.4. To achieve the purposes of processing, the Operator may engage third parties providing hosting, communication, e-mail, protection against automated requests and web analytics services. Such parties are obliged to keep personal data confidential and secure.

6.5. The Operator does not sell personal data or share it with third parties for advertising or marketing purposes.

6.6. Personal data is provided to government authorities only in the cases and in the manner established by the laws of the Republic of Kazakhstan.

6.7. Cross-border transfer of personal data takes place only where its protection is ensured in accordance with Article 16 of the Law.

7. Retention periods

7.1. Personal data is kept no longer than required by the purposes of processing and no longer than three years after the User’s last request, unless a different period is set by the laws of the Republic of Kazakhstan or a contract.

7.2. Once the purposes of processing are achieved, or when consent is withdrawn, personal data is destroyed or depersonalised within thirty calendar days, unless further storage is required by law.

8. Data protection

8.1. The Operator takes the necessary legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying and dissemination.

8.2. These measures include data transfer over secure channels, access restriction and control, backups, depersonalisation of technical identifiers and regular review of the protection tools in use.

9. User rights

9.1. In accordance with Article 24 of the Law, the User has the right to:

• know whether the Operator holds their personal data and receive information about its processing;
• request that their personal data be changed or supplemented;
• request that their personal data be blocked where there are grounds to do so;
• request the destruction of their personal data processed in breach of the law;
• withdraw consent to the collection and processing of personal data, except as provided by law;
• protect their rights and legitimate interests, including by appealing the Operator’s actions to the authorised personal data protection body or to a court.

10. Requests from Users

10.1. Requests related to the processing of personal data, as well as withdrawal of consent, are sent to the Operator in writing to nysana.studio@gmail.com.

10.2. The Operator reviews the request and replies within the time limits established by the laws of the Republic of Kazakhstan.

11. Final provisions

11.1. The Operator may amend this Policy. A new version takes effect when it is published on the Website, unless the new version provides otherwise.

11.2. The current version of the Policy is always available on this page.

11.3. This Policy and the relationship between the User and the Operator are governed by the laws of the Republic of Kazakhstan.